registry  /  @pro-vi/designer  /  0.3.19

@pro-vi/designer@0.3.19

MCP + CLI for autonomous iteration of claude.ai/design — drives the design surface via agent-browser, downloads handoff bundles, and exposes a tasting harness for full-viewport variant comparison.

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 30 file(s), 261 KB of source, external domains: 127.0.0.1, claude.ai, github.com

Source & flagged code

6 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
bin/designer.mjsView file
4// dist/cli.js, falls back to tsx+source for dev/clone-and-run mode. L5: import { spawnSync } from 'node:child_process'; L6: import fs from 'node:fs';
High
Child Process

Package source references child process execution.

bin/designer.mjsView on unpkg · L4
dist/cli.jsView file
428endpoint (/design/v1/design/projects/<id>/download) in-page — no browser download L429: gesture needed — then unzips it. L430: ... L475: --json Emit a structured { ok, generatedAt, url, counts, results } JSON payload L476: on stdout instead of icons. Exit code is unchanged. L477: ... L539: function checkDeps() { L540: const rootLock = path.join(REPO_ROOT, 'package-lock.json'); L541: if (!fs.existsSync(rootLock)) { ... L562: c.stdout.on('data', (d) => (v += d.toString())); L563: c.on('error', () => resolve({ name: 'agent-browser installed', status: 'fail', detail: 'binary not found on PATH; install from https://github.com/agent-browser/agent-browser' })); L564: c.on('close', () => resolve({ name: 'agent-browser installed', status: 'ok', detail: v.trim() || 'present' }));
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L428
dist/cdp-ensure.jsView file
3import path from 'node:path'; L4: import { spawn } from 'node:child_process'; L5: import { defaultChromeBin, isChromeRunning, QUIT_CHROME_HINT } from "./cross-platform.js"; L6: import { isCdpEnabled } from "./cdp-env.js"; L7: const PORT = process.env.DESIGNER_CDP || '9222'; L8: const PROFILE = path.join(os.homedir(), '.chrome-designer-profile'); ... L11: try { L12: const res = await fetch(`http://127.0.0.1:${PORT}/json/version`, { signal: AbortSignal.timeout(1500) }); L13: return res.ok;
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cdp-ensure.jsView on unpkg · L3
scripts/designer-chrome.shView file
•path = scripts/designer-chrome.sh kind = build_helper sizeBytes = 1580 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/designer-chrome.shView on unpkg

Findings

4 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/designer.mjs
HighShell
HighSame File Env Network Executiondist/cdp-ensure.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/designer-chrome.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowWeak Cryptodist/cli.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings